CLAIMS: 

1 . An expression editor comprising: 

an expression tree representing an expression in prefix notation, the expression 
including a plurality of operators and operands; and 

a plurality of infix operators corresponding with the plurality of operators inserted 
into the prefix expression tree, wherein the plurality of operands and infix operators 
represent the expression in infix notation. 

2. The expression editor of claim 1 , wherein the plurality of operators are 
represented symbolically. 

3. The expression editor of claim 2, wherein the plurality of infix operators are 
represented textually. 

4. The expression editor of claim 1, wherein the expression tree comprises: 
a prefix tree side containing the operators and the tree structure, and 

an infix/prefix hybrid side containing the operands and the infix operators, 
wherein the prefix tree side is to the left of an invisible line and the infix/prefix hybrid 
side is to the right of the invisible line. 

5. The expression editor of claim 1, wherein each operator of the expression tree has 
a corresponding expansion box that is operable by a user to show or hide the operands of 
the corresponding operator. 
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6. The expression editor of claim 1, wherein the expression comprises a Boolean 
expression, the operators comprise Boolean operators, and the expression tree comprises 
a Boolean expression tree. 

7. The expression editor of claim 6, wherein the Boolean expression comprises a 
rule in a network security system. 

8. The expression editor of claim 7, wherein the expression editor comprises a rule 
editor of the network security system. 

9. The expression editor of claim 1 , wherein the plurality of operands and infix 
operators represent the expression in infix notation when read left-to-right and top-to- 
bottom. 

10. The expression editor of claim 1, wherein the infix operators include parentheses 
to indicate the order of operations implicit in the expression tree. . 

1 1 . The expression editor of claim 1 , wherein an insertion or deletion of an operator is 
reflected by a change in the corresponding infix operator. 

12. The expression editor of claim 1 , wherein an insertion of deletion of parentheses 
indicating an order of operations for the infix notation of the expression is reflected by a 
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change in the structure of the expression tree to implicitly represent the changed order of 
operations. 

13. A method of displaying an expression being capable of representation in infix and 
prefix notation, and comprising a plurality of operators and operands, the method 
comprising: 

displaying the expression as a prefix expression tree, wherein the plurality of 
operands comprise the leaves of the expression tree; and 

inserting a plurality of infix operators corresponding with the plurality of 
operators into the prefix expression tree, wherein, the plurality of operands and infix 
operators represent the expression in infix notation. 

14. The method of claim 13, wherein the plurality of operators are displayed 
symbolically. 

15. The method of claim 14, wherein the plurality of infix operators are displayed 
textually. 

16. The method of claim 13, wherein the expression tree is displayed as having: 
a prefix tree side containing the operators and the tree structure, and 

an infix/prefix hybrid side containing the operands and the infix operators, 
wherein the prefix tree side is to the left of an invisible line and the infix/prefix hybrid 
side is to the right of the invisible line. 
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17. The method of claim 1 6, wherein inserting the plurality of infix operators 
comprises inserting an open parenthesis to correspond with each operator, the open 
parentheses being displayed on the same horizontal line on the infix/prefix hybrid side as 
the operator occupies on the prefix tree side. 

1 8. The method of claim 1 6, wherein inserting the plurality of infix operators 
comprises inserting an infix operator on the infix/prefix hybrid side corresponding with 
each operator on the prefix tree side in front of all operands except the first operand of 
each operator. 

19. The method of claim 16, further comprising updating the prefix tree side to show 
corresponding changes on the infix/prefix hybrid side. 

20. The method of claim 16, further comprising updating the infix/prefix hybrid side 
to show corresponding changes on the prefix tree side. 

21. The method of claim 13, wherein the expression comprises a Boolean expression, 
the operators comprise Boolean operators, and the expression tree comprises a Boolean 
expression tree. 

22. The method of claim 21 , wherein the Boolean expression comprises a rule in a 
network security system. 
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23. A network security system comprising: 

a plurality of software agents to collect security events from a plurality of monitor 
devices; 

a manager including a rules engine to correlate the collected security events 
according to a set of rules; and 

a console interface to edit a rule from the set of rules using a graphical user 
interface, the graphical user interface comprising a Boolean expression tree to represent 
the rule in prefix notation, the rule including a plurality of operators and operands, and a 
plurality of infix operators corresponding with the plurality of operators inserted into the 
Boolean expression tree, wherein the plurality of operands and infix operators represent 
the rule in infix notation. 
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